AI Discovers Nearly 5,000 Bitcoin Vulnerabilities in 27.5 Hours

Article by Xiao Bing

16 individuals, 27.5 hours, 4,962 security issues, 85 critical vulnerabilities, 635 high-risk vulnerabilities.

This set of numbers comes from Bitcoin Red Team, a volunteer organization. Over the past two days, they conducted a comprehensive security audit of 390 open-source Bitcoin projects using AI models, submitting an average of 166 findings per hour and identifying one critical vulnerability per person per hour.

Calle, founder of the Cashu protocol, released the first battle report on X, opening with four characters that summarize the situation: "The situation is extremely dire."

But what's truly concerning isn't the numbers themselves.

This audit was not initiated arbitrarily.

A week ago, the Bitcoin ecosystem experienced the largest hardware wallet security incident in history. Due to a flaw in the random number generator introduced in a firmware update in 2021, Coldcard wallets allowed private keys to be offline-calculated. Starting July 30, attackers launched four waves of attacks, compromising over 5,200 addresses. According to tracking data from Galaxy Research, approximately 1,816 BTC were stolen, worth over $116 million at the time.

This bug lay quietly in the public code for five years, open to audit by anyone, yet almost no one examined it systematically.

The Coldcard incident was the catalyst. Calle and AnchorWatch CEO Rob Hamilton quickly assembled a Red Team, secured funding from OpenSats, and spent over $40,000 on AI compute power. The models they used included Moonshot's Kimi K3, OpenAI's GPT Sol, Anthropic's Fable and Opus, and Zhipu's GLM5.2.

In the early stages of the project, access to OpenAI and Anthropic’s models was restricted, so the team primarily relied on Chinese open-source models. This detail itself is intriguing: the security of the world’s largest cryptocurrency infrastructure is being guarded by volunteers working through the night with Chinese open-source AI.

The data puzzle after 27.5 hours looks like this: Of 4,962 issues, 14.5% are classified as high-risk or critical, with an average of 1.85 critical issues per project. Privacy and CoinJoin tools had the highest proportion of critical findings at 24%, followed by exchanges and swap protocols at 21%. Cryptographic libraries and SDKs generated the largest volume of raw findings (1,101), but their critical rate was only 10%. 91% of findings were submitted via automated scanning, and 21% have been locally reproduced using proof-of-concept code.

Among the 17 contributors, 14 are human and 3 are automated systems.

Rob Hamilton wrote on X: "The hardest part isn't finding bugs—it's getting them to the right people."

In the world of traditional security research, "discovery" is the most expensive step. A top security researcher might spend weeks reverse-engineering code to find an exploitable vulnerability. AI has reduced this cost to nearly zero. Sixteen people working with an AI model can produce in one day what a security audit firm would typically accomplish in months.

The issue arose after discovery. By the time the report was released, only 19 out of 390 audited projects (less than 5%) had completed upstream disclosure. Calle apologized to maintainers in a tweet, acknowledging that the surge of reports had increased their pressure, and that the team is still learning how to filter out noise. Eight of the findings have been retracted as false positives.

This is a structural shift: AI has turned "finding bugs" into an almost free activity, causing the bottleneck in the entire security pipeline to instantly shift from the upstream discovery phase to the mid- and downstream stages—verification, classification, routing to the right maintainers, fixing, testing, and deploying patches. These stages still heavily rely on human effort, remain slow, and are still chaotic.

And this is precisely where attackers have a structural advantage.

Defenders must complete an entire chain of steps: discovering a vulnerability → validating it → responsible disclosure → waiting for maintainers to acknowledge it → fixing it → pushing a patch → and users updating. Each step involves friction and delays.

Attackers only need: discover the vulnerability → exploit it.

AI has made the starting point of the attack chain inexpensive for both sides. However, the asymmetry in subsequent steps means this arms race inherently favors the attacker. The Coldcard case is clear proof: a bug from 2021 remained publicly exposed in the codebase for five years; defenders conducted no systematic scans, while attackers used AI to identify predictable key spaces, draining 1,083 BTC in just 41 minutes.

A stronger signal has emerged. In April this year, Anthropic unveiled Claude Mythos Preview, an AI model deemed too risky to release publicly. According to Anthropic, Mythos was able to identify a single vulnerability at a computational cost of less than $50 and autonomously discovered a 27-year-old flaw in the OpenBSD operating system. OpenBSD is one of the world’s most widely recognized secure operating systems, extensively used to run firewalls and critical infrastructure. In response, Anthropic launched Project Glasswing, collaborating with approximately 40 organizations—including AWS, Apple, Microsoft, and Google—to patch vulnerabilities before attackers can exploit them.

In May, Google's Threat Intelligence Team announced another milestone: they intercepted a criminal group using an AI model to discover a zero-day vulnerability and write exploit code. The vulnerability was a two-factor authentication bypass embedded in a widely used open-source management tool. Google identified the source of the attack through AI-specific characteristics in the code—such as fabricated CVSS scores and textbook-style Python comments—and collaborated with the vendor to patch it before the criminal group launched large-scale exploitation.

John Hultquist, Chief Analyst for Google Threat Intelligence, left no room for doubt: "The notion that an AI vulnerability arms race is coming is a misjudgment. The reality is that the race has already begun."

Ledger CTO Charles Guillemet, commenting on the Coldcard incident, said something widely quoted: “Open source and audited are two different things.”

This statement punctures a long-standing myth in the crypto industry. The Bitcoin community holds an almost religious belief that open-source code, by virtue of being publicly visible, is inherently secure. Coldcard’s code has been public for five years. The Red Team audit covered 390 projects. Put together, these facts make the picture clear: auditable does not mean audited.

The Red Team’s experience also revealed the limitations of AI security audits. Calle said that most of the team’s work still involved “manually guiding AI,” with each member prompting the model in their preferred way, resulting in broader coverage than a uniform approach. This suggests that current AI security audits are more akin to “human experts driving AI tools” rather than “AI autonomously patrolling.” While models can quickly scan for code patterns, determining whether a finding is truly exploitable, assessing its potential impact, and deciding whom to notify still require human expertise and judgment.

Hamilton said the team plans to open-source the audit framework, allowing Bitcoin companies to run the same scans on their proprietary code. This is the right direction, but it also means the same tools will inevitably fall into the hands of attackers.

What this audit truly reveals is a new equation taking shape:

AI has brought the cost of discovering vulnerabilities close to zero. However, the cost of fixing vulnerabilities—organizational coordination, human effort, and user migration—remains high and slow.

$40,000 in AI computing power for 27.5 hours was enough to turn over an open-source ecosystem managing hundreds of billions of dollars. A five-year-old bug in Coldcard, unnoticed by anyone, was exploited by attackers who drained $116 million in just 41 minutes.

The security narrative around Bitcoin is being rewritten.

The old logic was: "The code is open-source, so it's secure." The new logic is harsher: "The code is open-source, so attackers are using AI to scan it."

The defender's only advantage is the first-mover benefit—finding and patching vulnerabilities before the attacker does. The Red Team is competing for this first-mover advantage, but their reports also show that even with the first-mover edge, the subsequent patch distribution chain remains the weakest link in the ecosystem.

The challenges facing Bitcoin may merely be a preview of a larger transformation. The entire open-source software world is about to face the same question: when finding bugs no longer requires experts, but fixing them still does, what will bridge this gap?